Do you have any servers with less than 30gb of free disk space? I have also noticed that you have set in the query to not include the C:\ drive.

hello dear,

i used the code put but did not receive any alert

noting that my code is as per below
let setgbvalue = 30;

Perf
| where TimeGenerated > ago(1h)
| where ObjectName == “LogicalDisk” and CounterName == “Free Megabytes”
| where InstanceName !contains “C:”
| where InstanceName !contains “_Total”
| extend FreeSpaceGB = CounterValue/1024
| summarize FreeSpace = min(FreeSpaceGB) by Computer, InstanceName
| where FreeSpace < setgbvalue

Hello, You can add another | where to the query.

| where InstanceName !contains “HarddiskVolume1”

Just add it under the last | where InstanceName

i used the code , however my report shows HarddiskVolume1 which my temp Drive , how do i remove this ?

appreciate your help thus far

excellent post

Hello,

To remove the d:\ from the report you can use the following code.

// enter a GB value to check
let setgbvalue = 100;
// Query
Perf
| where TimeGenerated > ago(1h)
| where ObjectName == “LogicalDisk” and CounterName == “Free Megabytes”
| where InstanceName !contains “D:”
| where InstanceName !contains “_Total”
| extend FreeSpaceGB = CounterValue/1024
| summarize FreeSpace = min(FreeSpaceGB) by Computer, InstanceName
| where FreeSpace < setgbvalue I have updated the code above now also. Thanks.